Privacy Policy

1Who we are

LeakHunt is operated by Akash Chaterjee, trading as WEBx47 (“we”, “us”, “our”), of Mansarovar, Jaipur, RJ, 302020, IN. LeakHunt is a Shopify app that finds a store’s discount codes published on public coupon sites, verifies which of them still work, lets the merchant disable them, and rejects leaked codes at checkout for shoppers whose browser is running a coupon extension.

For the personal data described below, the merchant who installs LeakHunt is the data controller and we act as a data processor on their behalf.

2Data we process

Merchant account data. We store the name and email address of the store owner and staff who open the app, obtained through Shopify authentication, together with the store’s domain. This is used to operate the app and provide support.

Store settings. Where a merchant chooses to receive email alerts, we store the email addresses they enter for that purpose. We also store any discount codes the merchant adds to their whitelist or marks as intentional. These are merchant-supplied business settings, not shopper data.

Discount code data. To find leaked codes, we send the store’s public storefront domain to LeakScout, our in-house scanning service, which reads publicly available coupon pages on LeakHunt’s behalf. Candidate codes are checked against the store’s discounts through Shopify. We store only codes that exist in the store, together with the coupon sites they were found on, their status, and when we first saw them. This is information about the store’s discounts, not about any individual.

Checkout protection data. When Extension Guard is on and a shopper’s browser is running a recognised coupon extension, LeakHunt records on that shopper’s Shopify cart which extensions were detected and the list of leaked codes to reject. This is written to the merchant’s own Shopify store, where Shopify may copy it onto the resulting order. LeakHunt does not store this data in its own systems, and does not receive the shopper’s name, email address, address, or payment details. To show the merchant how many orders were protected, we count orders in the merchant’s store that carry this marker; we do not store order or customer details.

Billing data. We keep a record of the store’s subscription status with Shopify, and, where the merchant activates LeakHunt through PromoLock, confirmation from PromoLock that the store holds an active PromoLock plan.

We use all of the above only to provide LeakHunt’s functionality. We do not sell personal data or use it for marketing, profiling, or any unrelated purpose.

3Where data is stored & how long we keep it

Data we store is held in a database operated via PlanetScale and hosted on Amazon Web Services in the United States, encrypted at rest and in transit. The app itself runs on Vercel.

Merchant account data, store settings, and discount code data are retained for the duration of the app installation and deleted when the merchant uninstalls LeakHunt or when Shopify sends a store redaction request.

The billing record (the store’s domain and its subscription facts, including when a free trial was started) is kept after uninstall so that a free trial cannot be claimed twice. It contains no personal data beyond the store domain.

4Sub-processors

We rely on the following sub-processors to provide the service. Each processes data only as needed to support LeakHunt:

• Vercel, Inc. — application hosting (United States)
• Amazon Web Services, Inc. — database hosting (United States)
• PlanetScale, Inc. — database platform (United States)
• Upstash, Inc. — scheduling of LeakHunt’s background scans (United States)
• Resend, Inc. — delivery of email alerts to the addresses the merchant lists (receives those addresses and the alert content)
• Railway Corporation — hosting of LeakScout, our in-house scanning service (receives only the store’s public storefront domain)

5International data transfers

Where personal data of individuals in the UK or EU is transferred to the United States or India, those transfers are made under appropriate safeguards, including the Standard Contractual Clauses adopted by the European Commission and their UK equivalent.

6Security

We apply appropriate technical and organisational measures to protect personal data, including encryption at rest and in transit, access controls, separation of production and test environments, and limiting the data we store to what each feature requires.

7Data subject rights

Individuals may exercise their rights — access, correction, and deletion — by contacting the merchant, who is the data controller. We assist merchants in responding to these requests and honour Shopify’s mandatory privacy webhooks. LeakHunt does not store personal data about a merchant’s customers, so a customer data request returns no records and a customer redaction request has nothing to delete; a store redaction request deletes all data associated with the store as described in Section 3.

8Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised “last updated” date.

9Contact

Questions about this policy can be sent to support@leakhunt.app